Extracted

• • Target

    Video clip.MP4.xls

  • Size

    1.0MB

  • MD5

    121e603042747acbd8d1fb2c55eaf080

  • SHA1

    4a3d57363b240fd6644d9bc0f6abca7ec9cf3992

  • SHA256

    e33e207971d05a656690c2ebd86e3f090f3e50d37b16320a69bc5c92f4402cd5

  • SHA512

    d18c5dd7c620ab6827547bdf671cae9ae7809d2399650c45eb85809d7b81cff3e5a6ddd38b51eb2b93acd0ff400732b3a5de2325803d09ec92539e39e7c898b0

  • SSDEEP

    24576:tr5XXXXXXXXXXXXUXXXXXXXSXXXXXXXX9mur5XXXXXXXXXXXXUXXXXXXXSXXXXXo:UPTKo

  Score

  10^/10

  formbookdo25ratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Formbook payload

    rat

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2